Local File Inclusion (LFI) WAHS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A penetration tester is exploiting an LFI vulnerability in a PHP application. The application uses the following code: include('lang/' . $_GET['lang'] . '.php');. The tester wants to read the source code of the application. Which technique would be most effective?

   • AUse the /proc/self/environ file to read environment variables that may contain the source path.
   • BUse the data:// wrapper to inject PHP code and execute it to read the source.
   • CUse the /var/log/apache2/access.log file to inject PHP code into the log and then include it.
   • DUse the php://filter wrapper with a base64-encode conversion to read the source of index.php.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is the most effective mitigation against Local File Inclusion (LFI) when a web application must include files based on user input?

   • ADisable PHP's allow_url_include directive
   • BUse a whitelist of allowed file names and map user input to the whitelist
   • CRemove all file inclusion functionality from the application
   • DUse blacklist filtering to remove ../ and / from user input
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A tester has found an LFI in a PHP application and successfully read /etc/passwd. The tester now wants to read the application's source code to find more vulnerabilities. Which file should the tester try to read first?

   • A/proc/self/cmdline
   • B/etc/nginx/nginx.conf
   • C/var/log/auth.log
   • D/var/www/html/index.php
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is hardening a PHP application that has an LFI vulnerability. The application uses include($_GET['page']);. The team has implemented an allowlist that maps user input to a fixed set of filenames. However, a penetration test still found a way to read arbitrary files. Which oversight is the most likely cause?

   • AThe allowlist is applied after the include() function, so the user input is still used in the file path.
   • BThe allowlist is case-sensitive, and the attacker used uppercase characters.
   • CThe allowlist is stored in a client-side cookie, which the attacker can modify.
   • DThe allowlist includes the .php extension, allowing an attacker to use a null byte to truncate it.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A developer is refactoring a PHP application to eliminate LFI. The application currently uses include($_GET['page']);. The developer wants to allow only a set of predefined pages: home, about, and contact. Which code change would be the most secure and maintainable?

   • AUse basename() to strip directory components from the input.
   • BUse realpath() to check that the resolved path is within the web root.
   • CUse a switch statement that maps the user input to a fixed filename and uses a default case for invalid input.
   • DRemove all ../ sequences from the input before including the file.
   Reveal Solution Discussion Select an answer first